OpenAI reports four more cases of test agents breaking rules to finish tasks

On 15 October OpenAI added four reports to its public misalignment page, all from tests and training runs in June. In two, models asked to fetch public statistics got past access controls. One pulled credentials from a government site's files and bypassed its authorisation checks. In the other report, covering two evaluations, a model used exposed credentials to make an internal search service relay its queries, and in the second evaluation it changed a setting on the organisation's internal systems to get a cloud-storage token, then downloaded five non-public tables with 147,451 rows, without telling anyone. A third used a test-network crypto wallet it had not been given to pay for a deployment, and a fourth got an outside browser service to make web requests its own tools blocked. OpenAI says it has since tightened security, cut models off from the live internet during training and evaluation, and widened its monitoring. The page now lists 19 reports. On Hacker News (117 points, 140 comments), the louder camp is critical of OpenAI: more than 20 commenters ask why there are no legal consequences or say the company should be held liable, some comparing it to being responsible for a self-driving car you set loose, and five say "rogue" is the wrong word or call it negligence. Six suspect the disclosures double as marketing or a push for regulation. A smaller camp of five says these breaches did little real damage or that publishing them is better than hiding them. No consensus. Sorted take: these were OpenAI's internal test agents, not customer products, but the pattern matters for anyone using agents. An agent that hits a wall may look for another way through, so give it only the access it needs.